Amended  IN  Assembly  March 16, 2023

CALIFORNIA LEGISLATURE— 2023–2024 REGULAR SESSION

Assembly Bill
No. 793

Introduced by Assembly Member Bonta
(Coauthors: Assembly Members Friedman and McKinnor)

February 13, 2023

An act to add Chapter 3.8 (commencing with Section 1546.8) to Title 12 of Part 2 of the Penal Code, relating to privacy.


LEGISLATIVE COUNSEL'S DIGEST


AB 793, as amended, Bonta. Privacy: reverse demands.
The United States Constitution generally requires a state to give full faith and credit to the public acts, records, and judicial proceedings of every other state. Existing law sets forth procedures by which a person may enforce a judgment for the payment of money issued by the court of a state other than California.
Existing law, the Electronic Communications Privacy Act, determines how governmental entities may access information on electronic devices and from electronic communication service providers, as defined. Existing law requires a California corporation that provides electronic communication services or remote computing services to the general public to comply with a warrant issued by another state to produce records that would reveal the identity of the customers using those services, data stored by, or on behalf of, the customer, the customer’s usage of those services, the recipient or destination of communications sent to or from those customers, or the content of those communications as if that warrant had been issued by a California court, except as specified.
This bill would prohibit any government entity from seeking, or any court from enforcing, assisting, or supporting, a reverse-keyword or reverse-location demand, as defined, issued by a government entity or court in this state or any other state. The bill would prohibit a person or California entity from complying with a reverse-keyword or reverse-location demand. The bill would authorize a court to suppress any information obtained or retained in violation of these provisions, the United States Constitution, or California Constitution. The bill would authorize the Attorney General to commence a civil action for compliance with these provisions.
The bill would require a government entity to immediately notify any person whose information was obtained in violation of these provisions of the violation and of the legal recourse available, as specified. The bill would authorize an individual whose information was obtained, or a service provider or other recipient of the reverse-keyword or reverse-location demand to file a petition to void or modify the demand or order the destruction of information obtained in violation of these provisions. The bill would authorize an individual whose information was obtained by a government entity in violation of these provisions to bring a civil suit against the government entity for damages, injunctive or declaratory relief, or other relief that the court deems proper.
The bill would make these provisions severable.

Existing law, the Reproductive Privacy Act, provides that every individual possesses a fundamental right of privacy with respect to their personal reproductive decisions. Existing federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), establishes provisions relating to the confidentiality of health records. Existing law, the California Privacy Rights Act of 2020 (CPRA), approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to require the business to delete personal information about the consumer, as specified, unless those obligations restrict a business’ ability to, among other things, comply with federal, state, or local laws or comply with a court order or subpoena to provide information, or cooperate with a government agency request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury, as provided.

This bill would state the intent of the Legislature to enact legislation related to protecting the privacy of those seeking reproductive and gender-affirming care.

Vote: MAJORITY   Appropriation: NO   Fiscal Committee: NOYES   Local Program: NO  

The people of the State of California do enact as follows:


SECTION 1.

 The Legislature finds and declares all of the following:
(a) California is proud to be a safe haven for reproductive rights, health care access, gender-affirming care, and digital privacy, and has long been at the forefront of protecting these fundamental rights.
(b) When it comes to protecting reproductive and LGBTQI rights and safety, our digital trail is highly revealing and must be safeguarded. With states across the country passing antiabortion and antitrans legislation, including laws that criminalize people for accessing care or helping people access care, it is vital that California continue to protect against digital tracking of vulnerable people seeking health care.
(c) Reverse-location and reverse-keyword demands can compel companies to search their records and reveal the identities of all people who looked up a particular keyword online or drove down a certain street.
(d) People in California have a fundamental, inalienable right of privacy under the California constitution with respect to personal reproductive and health care decisions and digital privacy, but dragnet surveillance from reverse-location and reverse-keyword demands severely undermines the right to privacy, especially for people seeking abortions and gender-affirming care.
(e) California also robustly protects people’s right to protest and free expression.

(e)

(f) Reverse demands can also chill the exercise of the freedom of speech, association, religion, assembly, movement, and the press.

(f)

(g) These mass surveillance demands have been used to track the locations and identities of people protesting police violence and could easily be used by local law enforcement in states across the country to request the names and identities of people whose digital trail shows they have visited California abortion or gender-affirming care providers or even searched for revealing keywords online.

(g)

(h) General warrants are expansive and invasive searches by the government that fail to identify specific persons, devices, or places to be searched with evidence of probable cause. Since our nation’s founding, general warrants have been deemed a significant threat to personal freedom, privacy, and liberty. The United States Supreme Court has repeatedly held that the Fourth Amendment to the United States Constitution prohibits the use of general warrants.

(h)

(i) Reverse demands have the same practical effect as unconstitutional general warrants, and courts have found reverse-location demands unconstitutional.

(i)

(j) Legislation is necessary to preserve our right to safely seek reproductive and gender-affirming care in the digital age by protecting us from these invasive, harmful, and likely unconstitutional searches of our personal information. Legislation is also necessary to prevent the chilling or punishment of people engaging in constitutionally protected protest and free expression.

SEC. 2.

 Chapter 3.8 (commencing with Section 1546.8) is added to Title 12 of Part 2 of the Penal Code, to read:
CHAPTER  3.8. Reverse-keyword and Reverse-location Demands

1546.8.
 For the purposes of this chapter, the following definitions apply:
(a) “Government entity” means a department or agency of the state or a political subdivision thereof, or an individual acting for or on behalf of the state or a political subdivision thereof.
(b) “California entity” means a California corporation or a corporation whose principal executive offices are located in California.
(c) “Compulsory process” means any court order, including a search warrant, a subpoena or administrative subpoena, or any other legal process seeking to compel the disclosure of records or information.
(d) “Reverse-keyword demand” means any action by any government entity, seeking or obtaining records or information capable of identifying persons who electronically searched or queried for a particular word or words, phrase or phrases, character string or strings, or website or websites, or who visited a particular website through a link returned in response to such a search or query, regardless of whether the request is limited to a specific geographic area or timeframe. “Reverse-keyword demand” includes any compulsory process seeking such records or information and any action seeking to obtain such records or information in exchange for valuable consideration.
(e) “Reverse-location demand” means any action by a government entity, seeking records or information pertaining to the location of unspecified electronic devices or their unspecified users or owners, whose scope extends to the electronic devices present in a given geographic area at a given time, whether such device location is measured via global positioning system coordinates, cell tower connectivity, Wi-Fi positioning, or any other form of location detection. “Reverse-location demands” shall include any compulsory process seeking such records or information and any action seeking to obtain such records or information in exchange for valuable consideration.

1546.81.
 (a) A government entity shall not make a reverse-location demand or a reverse-keyword demand.
(b) A government entity shall not seek, from any court, a compulsory process to enforce a reverse-location demand or a reverse-keyword demand.
(c) A court subject to the laws of this state shall not enforce, including through a compulsory process, a reverse-location demand or a reverse-keyword demand.
(d) A government entity shall not seek, secure, obtain, borrow, purchase, use, or review any information or data obtained through a reverse-location demand or a reverse-keyword demand.
(e) A person in this state or a California entity shall not be obligated to comply with a reverse-location demand or a reverse-keyword demand issued by the State of California or a political subdivision thereof or any other state or a political subdivision thereof.
(f) A person or entity shall not be obligated to comply with a reverse-location demand issued by the State of California or a political subdivision thereof or any other state or a political subdivision thereof, when the reverse-location demand seeks information about a location within the State of California or a reverse-keyword demand where the search or query that the recipient of the demand has reason to know pertains to a location in the State of California.
(g) A court or government entity of the State of California, or a political subdivision thereof, shall not support, assist, or enforce a reverse-location demand or reverse-keyword demand issued by the State of California or a political subdivision thereof, or any other state or a political subdivision thereof, including the domestication of any such demand.
(h) A government entity shall not seek the assistance of a nongovernmental entity, an agency of the federal government, or an agency of the government of another state or subdivision thereof in obtaining information or data from a reverse-location demand or reverse-keyword demand if the government entity would be barred from directly seeking that information under this chapter.

1546.82.
 (a) A person in a trial, hearing, or proceeding claiming that information was obtained or retained in violation of the California or United States Constitutions or this chapter may file a motion to suppress. Any information obtained or retained in violation of the California and United States Constitutions or this chapter shall be suppressed.
(b) The Attorney General may commence a civil action to compel a government entity to comply with the provisions of this chapter.
(c) An individual whose information is disclosed a manner that is inconsistent with this chapter or the California or United States Constitutions, or a service provider or any other recipient of the reverse-location demand or reverse-keyword demand, may file a petition to void or modify the reverse-location demand or reverse-keyword demand, or to order the destruction of any information obtained in violation of this chapter or the California or United States Constitutions.

1546.83.
 (a) A person whose information was obtained by a government entity in violation of this chapter shall be immediately notified of the violation and of the legal recourse available to that person pursuant to Section 1546.82. Notice shall be provided in writing by the government entity who committed the violation and by any entity that responded to the demand.
(b) A person whose information was obtained by a government entity in violation of this chapter may institute a civil action against the government entity for one or any combination of any of the following:
(1) One thousand dollars ($1,000) per violation or actual damages, whichever is greater.
(2) Punitive damages.
(3) Injunctive or declaratory relief.
(4) Any other relief that the court deems proper.
(c) In assessing the amount of punitive damages, the court shall consider all of the following:
(1) The number of people whose information was disclosed.
(2) Whether the violation directly or indirectly targeted persons engaged in exercises of activities protected by the California or United States Constitutions.
(3) The persistence of violations by the particular government entity.
(d) In any successful action brought under this section, the court shall award reasonable attorney’s fees to a prevailing plaintiff.

SEC. 3.

 The provisions of this act are severable. If any provision of this act or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.
SEC. 2.

It is the intent of the Legislature to enact legislation to preserve our right to safely seek reproductive and gender-affirming care in the digital age by protecting us from unconstitutional reverse demands.